GCVE-110-OSM-2025-1097

PolinRider malware fork of stackblitz-labs/bolt.diy (19,885 stars) staging upstream injection. The fork's eslint.config.mjs contains the PolinRider obfuscated payload. === UPSTREAM INJECTION ATTEMPT === Attack type: Fork-and-PR upstream injection Fork repo: rmcsharry/bolt.diy Parent repo: stackblitz-labs/bolt.diy (19,885 stars) Fork created: 2025-09-19 === PAYLOAD === Infected file: eslint.config.mjs Signature: primary v1 (rmcej%otb%,2857687) + global['!'] + _$_1e42 decoder === PR STATUS === 1 merged PR from this account to parent exists but is unrelated to the payload files (predates infection) Parent infected: No (near miss)